If I'm given a URL that points to a .txt file, is it always safe to open it? Can it possibly contain virus or malicious content?
Add a comment
|
2 Answers
A file named .txt, can still have a "dangerous" content type. E.g. Apache allow you to set "Content-Type: text/html" on .txt files (or to what ever on what ever). A file with content-type "text/html" will be rendered as a html page in the browser.
-
This is a good answer and is a typical audit test. Load a simple script tag into a text document with an alert, load it to your host and open it via the browser. Since the type is text/html, in many browsers the JS will execute and may be malicious in nature. (That said, the mime type could be anything, but this is an example of why one has to be careful of how they redisplay uploaded files).– iivelOct 19, 2012 at 22:23
-
It is not safe. It can be malicious.
The last four characters of the URL being ".txt" has no actual significance to the type of file that is sent to your browser, and in most cases won't affect how it handles the file. The important part is the Content-Type header of the HTTP response. http://foo.com/bar.txt could easily be a web page, or a flash video, or an mp3 file, or a java applet, or any of a hundred other things. I am sure you have been to plenty of web pages that don't end in ".html" (like the one you're reading this on right now).
